A practical checklist we use during architecture reviews. Print it, share it, run it against your own system before you pay for a review.
→ Structure: 3 checks…
→ Data: 3 checks…
→ Scaling: 3 checks…
→ Security: 3 checks…
⚠ 5/12 checks failed
⚠ 2/12 checks uncertain
✓ 5/12 checks passed
✓ Better than 80% of systems we review
This is the checklist we run through during every architecture review. It is not exhaustive — every system has unique risks — but it covers the most common issues we find. If you can answer all 12 confidently, you are in better shape than 80% of the systems we review.
1. Can you draw your system on one page and have a new developer understand it in 10 minutes? 2. Does every component have a clear owner (team or person)? 3. Are module boundaries enforced by code (interfaces, build checks) or just by convention?
4. Is your database doing one thing (transactions) or five (transactions, search, queue, cache, analytics)? 5. Do you have a backup strategy that you have actually tested by restoring? 6. Is sensitive data encrypted at rest and in transit?
7. Do you know which component will break first under 10x load? 8. Are your external API calls resilient (timeouts, retries, circuit breakers)? 9. Can you deploy without downtime?
10. Are secrets stored outside version control (and Git history)? 11. Is access control enforced on every API endpoint, not just the UI? 12. Are dependencies scanned for known vulnerabilities in your CI pipeline?
Go through each item with your team. For every "no" or "not sure," that is a candidate for improvement. Do not try to fix everything at once — prioritise by risk and effort. Fix the cheapest high-risk item first.
If you want a professional review with detailed findings, prioritised recommendations, and a roadmap — that is what our architecture review service does. But this checklist will get you started.
Most systems work fine at current load. The question is whether they will work at 10x. Here are the five warning signs we look for in every architecture review.
20 Aug 2026Everyone asks this question. The answer is not "it depends" — it is "start with a modular monolith and extract services when you have a reason to." Here is why.
10 Aug 2026We apply the same rigour to real client engagements. Architecture reviews, security audits, and stack recommendations — all fixed-price, all actionable.